From 2c7eb483b5f3d8c4e658c541f9b396c3e7727a57 Mon Sep 17 00:00:00 2001 From: schwarze Date: Wed, 10 Aug 2016 12:04:57 +0000 Subject: [PATCH] When validating a .Bl list that defaults to -item for want of a type, don't let a subsequent -width access mdoc_argnames[] out of bounds. Found by tb@ with afl(1). --- usr.bin/mandoc/mdoc_validate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/usr.bin/mandoc/mdoc_validate.c b/usr.bin/mandoc/mdoc_validate.c index 41e9920cacc..68086efd59c 100644 --- a/usr.bin/mandoc/mdoc_validate.c +++ b/usr.bin/mandoc/mdoc_validate.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mdoc_validate.c,v 1.218 2016/08/09 15:08:15 schwarze Exp $ */ +/* $OpenBSD: mdoc_validate.c,v 1.219 2016/08/10 12:04:57 schwarze Exp $ */ /* * Copyright (c) 2008-2012 Kristaps Dzonsons * Copyright (c) 2010-2016 Ingo Schwarze @@ -500,6 +500,7 @@ post_bl_norm(POST_ARGS) mandoc_msg(MANDOCERR_BL_NOTYPE, mdoc->parse, n->line, n->pos, "Bl"); n->norm->Bl.type = LIST_item; + mdoclt = MDOC_Item; } /* -- 2.20.1